Port 2401: CVS Pserver — Where the World's Source Code Used to Live

What Runs on Port 2401

CVS pserver. The password-authentication access method for the Concurrent Versions System (CVS), the version control software that dominated open-source development from the early 1990s until Subversion arrived around 2000.

When you connected to a remote CVS repository with :pserver:, your client opened a TCP connection to port 2401. You sent your username, a weakly scrambled password, and the path to the repository. The server either accepted or rejected you, and then you could check out, update, and commit code.

Port 2401 is officially registered with IANA for this purpose—assigned to Jim Kingdon, one of CVS's core developers, at the address kingdon&harvey.cyclic.com.¹

The Protocol

CVS pserver is blunt. The authentication handshake looks like this:

BEGIN AUTH REQUEST
/path/to/repository
username
Ascrambledpassword
END AUTH REQUEST

The server responds with either I LOVE YOU (accepted) or I HATE YOU (rejected). This is real. The CVS protocol spec uses those exact strings.²

After authentication, the full CVS protocol runs over the same connection—file transfers, diffs, commit messages, all of it over TCP.

The Security Problem

The password wasn't encrypted. It was scrambled—a simple substitution cipher that the CVS manual acknowledges provides essentially no security against a determined attacker.² Anyone sniffing the network could trivially recover passwords. The scrambling existed only to prevent casual shoulder-surfing of log files.

The CVS team knew this. The documentation says so directly. They offered it anyway because something is marginally better than nothing, and at the time, many CVS repositories were on trusted internal networks where the threat model was less acute.

This is why CVS also supported :ext: access—tunneling over SSH—for people who needed actual security. But pserver was simpler to set up, so it was everywhere.

Why This Port Mattered

CVS was the first version control system that let multiple developers edit the same codebase at the same time without locking files. Before CVS, you had to check out a file exclusively—nobody else could touch it until you checked it back in. CVS introduced the merge model: two developers could edit the same file concurrently, and the system would reconcile their changes.³

Dick Grune wrote the original CVS scripts in 1986 to collaborate with his students on a compiler at Vrije Universiteit in Amsterdam. Brian Berliner rewrote it in C in 1989.³ By the mid-1990s it had become the de facto infrastructure of open-source software.

The Linux kernel was managed in CVS. Apache was managed in CVS. Perl, Mozilla, GNOME—all CVS. For a decade, port 2401 was where the patches landed.

What Happened to It

Subversion (SVN) launched in 2000 as a "CVS done right" replacement. Git arrived in 2005, created by Linus Torvalds after a licensing dispute with BitKeeper forced the Linux kernel to find a new version control system.⁴ Git's distributed model made CVS's centralized server feel ancient almost overnight.

Projects migrated. CVS repositories went into read-only mode. Port 2401 went quiet on most of the Internet—though you'll still find legacy CVS servers running at universities, in older enterprise environments, and at projects that never finished migrating.

The Math

2401 = 49² = 7⁴

Someone noticed. The CVS developers chose a port number that's also the fourth power of seven. Whether this was intentional whimsy or post-hoc rationalization is lost to history. But people mention it, which is more than most port numbers get.

Checking What's on This Port

To see if anything is listening on port 2401 locally:

# macOS / Linux
lsof -i :2401

# Or with netstat
netstat -an | grep 2401

# Check a remote host
nmap -p 2401 hostname

A CVS pserver will respond to a connection attempt with silence until you send a properly formatted request. If you connect with telnet hostname 2401 and type BEGIN AUTH REQUEST, a live CVS server will wait for the rest of the handshake.